CVE-2026-102025
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-762
Impact
An authenticated network-based attacker can crash the routing protocol daemon (rpd), causing a denial of service across the device. They need established BGP peering with extended next-hop tunneling and SRv6 service processing enabled to trigger it with a malicious route update.
Root cause
The routing protocol daemon (rpd) mishandles memory using mismatched allocation and deallocation routines when processing specific BGP route updates.
Affected systems
Juniper Networks Junos OS and Junos OS Evolved; specific vulnerable version ranges are not listed in the advisory summary — check vendor advisory JSA112187.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the patched Junos OS / Junos OS Evolved release specified in Juniper advisory JSA112187. If patching must wait, temporarily disable SRv6 service processing or extended next-hop tunneling on untrusted BGP peer sessions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.